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The Information Commissioner’s response to the Department of 
J ustice’s consultation on proposals to amend the legislation 
governing the retention of DNA and fingerprints in Northern 
Ireland 


About the ICO 


1. The Information Commissioner has responsibility in the UK for 
promoting and enforcing the General Data Protection Regulation 
(GDPR), the Data Protection Act 2018 (DPA 2018), the Freedom of 
Information Act 2000, the Environmental Information Regulations 
2004 and the Privacy and Electronic Communications Regulations 
2003, amongst others. 


2. The Commissioner is independent from government and upholds 
information rights in the public interest, promoting openness by 
public bodies and data privacy for individuals. The Commissioner 
does this by providing guidance to individuals and organisations and 
taking appropriate action where the law is broken. 


Introduction 


3. The Information Commissioner’s Office (ICO) welcomes the 
opportunity to respond to this Department of J ustice ( Do} ) 
consultation. We have provided comments on the consultation 
document below in accordance with each of the headings within the 
consultation document for ease of reference. 


Retention of DNA and fingerprints of convicted persons 


4. We welcome the aim of the policy proposal to move away from 
indefinite retention of biometric data to a more nuanced retention 
regime. In relation to the 75/50/25 model proposed, we appreciate 
it is difficult to be specific about what is a reasonable retention 
period but we would expect the Do} to be able to provide evidence 
to support the assertion that these are acceptable retention periods, 
particularly with respect to the proportionality and necessity of 
retaining the records for such lengths of time. 
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5. By way of example, retaining biometric data for the maximum 75 
years of an individual who was convicted at the age of 20 of a 
serious violent offence would be a lifetime for the vast majority of 
people. Likewise, retaining the biometric data for the maximum 50 
years of an individual who was convicted at the age of 15 of a non- 
serious offence involving a custodial sentence of just over 5 years 
would result in that individual’s data being retained until they are 65 
years old. The Do} will need to be able to justify the retention 
period for such cases, for example, what evidence is available 
regarding that age group committing further offences. 


Periodic review of biometric data of convicted persons 


6. It is critically important that a mechanism is built into the regime to 
ensure continued retention is necessary and proportionate and we 
appreciate the intentions to do so as highlighted within the 
consultation document. This will ensure compliance with the fifth 
data protection principle set out within section 29, Part 3 of the DPA 
2018 which states that “Appropriate time limits must be established 
for the periodic review of the need for the continued storage of 
personal data for any of the law enforcement purposes.” 


7. Periodic reviews of retained biometric data will also will ensure that 
the data held is processed fairly (the first principle); adequate, 
relevant and not excessive (the third principle); accurate and kept 
up-to-date (the fourth principle); not kept for longer than is 
necessary for the purpose for which it is processed (the fifth 
principle); and securely kept, using appropriate technical and 
organisational measures (the sixth principle). 


8. If biometric data is to be retained for set maximum periods of time, 
this brings along with it a responsibility to ensure the processing is 
compliant with the principles for its lifetime. 


9. It should be made clear to individuals what the retention timeframes 
of their biometric data are to ensure full transparency, along with 
clarity that the timeframes are the maximum period of time that the 
Do] may retain their data and the process followed to determine 
whether the biometric data can be destroyed or should be retained. 
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10. We note that a separate consultation will take place for 
Regulations regarding a detailed review mechanism that will apply 
to all material falling within the 75/50/25 maximum retention 
periods. Please note that the ICO must be consulted directly during 
the drafting of these Regulations as required under Article 36(4) of 
the GDPR. 


Retention of material by virtue of a conviction outside the UK 


11. In relation to this policy intention, we would raise similar 
comments to that raised in paragraph 4 above, that the Do} should 
be able to demonstrate why the 50 and 25 year proposed retention 
periods are deemed acceptable, necessary and proportionate. It is 
unclear why a “simplified version” of 50 years and 25 years has 
been adopted in comparison to the 75/50/25 years set out within 
the first policy proposals, as this is inconsistent with the longer 
retention period for offences committed within the UK (for example, 
the biometrics of a person convicted of a serious violent, sexual or 
terrorism offence outwith the UK could be held for up to 25 years 
less than a person convicted of such offences within the UK). Whilst 
recognising that there may be difficulties in mapping offences 
committed abroad to offences committed in the UK, consideration 
should be given to setting retention periods in these circumstances 
on a case-by-case basis guided by rigorous procedure. 


12. It is also worth noting that such transfers will bring into play 
the international transfer considerations and requirements set out in 
Chapter 5, Part 3 of the Data Protection Act 2018 when data 
regarding criminal convictions is transferred to and from third 
countries or to an international organisation. We would direct you 
to our guidance for further information on the aforementioned 
considerations and requirements. 


Retention of material - Left on Books 


13. In relation to this policy intention, we would reiterate the 
comments raised in paragraph 4 above, that the Do} should be able 
to demonstrate why the 12 month proposed retention period is 
deemed acceptable, necessary and proportionate. Consideration 
could be given to a variable retention period according to the nature 
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of the allegation, reflecting the approach being taken for cases 
where a prosecution has been successful. 


Extension of the scope of the Northern Ireland Commissioner for 
the Retention of Biometric Material 


14. Biometric data is regarded as special category and sensitive 
personal data under the GDPR and DPA 2018 respectively and, as 
such, warrants special protection as well as additional stringent 
safeguards. In the context of policing, this is particularly important 
as not only is it information as to the physical health or condition of 
an individual, it can be information about their racial or ethnic origin 
and be related to an individual involved in the commission or alleged 
commission of a criminal offence. 


15. We note the policy intentions to widen the scope of the 
Northern Ireland Commissioner for the Retention of Biometric 
Material (the Biometric Commissioner) to provide independent 
statutory oversight of the acquisition, retention, use and disposal of 
biometric material. We would welcome an opportunity to meet with 
the Do} to discuss this further and, in particular, consider potential 
overlap with the functions of the Information Commissioner. This 
can form part of the formal consultation with us as required under 
Article 36(4) of the GDPR. 


Conclusions 


16. We hope the above comments are useful to the Doj in taking 
forward the proposed policy changes. We await formal consultation 
under Article 36(4) of the GDPR in respect of the legislative 
proposals you have outlined and reiterate our offer of a meeting in 
relation to the statutory oversight of biometric material. 
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